apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-07-03 20:41:00 +02:00
Code Issues Projects Releases Packages Wiki Activity

Dynamic (#77)

Browse source
This commit is contained in:
Eli Peter 2026-06-05 10:16:30 -05:00 • committed by GitHub
parent 55247b7fcd
commit 991c84a1eb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1464 changed files with 225448 additions and 1985 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/dynamic_fixtures/rust_frameworks/rocket/benign.rs Normal file
View file

@ -0,0 +1,13 @@
//! Phase 17 (Track L.15) — rocket benign control fixture.
use rocket::get;
use std::process::Command;
#[get("/run?<cmd>")]
pub fn run(cmd: String) -> &'static str {
let allow = ["ls", "ps"];
if allow.contains(&cmd.as_str()) {
let _ = Command::new(&cmd).status();
}
"ok"
}

14
tests/dynamic_fixtures/rust_frameworks/rocket/vuln.rs Normal file
View file

@ -0,0 +1,14 @@
//! Phase 17 (Track L.15) — rocket CMDI vuln fixture.
//!
//! The /run route forwards a `cmd` query parameter straight into
//! `std::process::Command`. Adapter binding: `#[get("/run?<cmd>")]`
//! on `run` with `cmd` arriving via the function's positional arg.
use rocket::get;
use std::process::Command;
#[get("/run?<cmd>")]
pub fn run(cmd: String) -> &'static str {
let _ = Command::new("sh").arg("-c").arg(&cmd).status();
"ok"
}